A space too big
to search

One · What a cipher actually is

We built a room with more doors than the universe has atoms, and then we lost the floor plan on purpose.

Here is the strange thing about cryptography, and it is strange enough that most descriptions skip past it. Cryptography is not primarily a way of hiding things. It is a manufacturing process. What it manufactures is bigness — a combinatorial space deliberately built to be too large for anyone to walk through, including the person who built it.

A 256-bit key is just 256 coin flips. Thirty-two bytes. You could write one on a napkin. But the set of all possible napkins is 2²⁵⁶ — about 1.16 × 10⁷⁷ — and that number does not have a referent. It is not large the way a national debt is large. There is no collection of objects anywhere in the known universe you could point at and say: that many. The observable universe contains something like 10⁸⁰ atoms, and 2²⁵⁶ is about a thousandth of that — which is the closest we get to a comparison, and it should tell you that the comparison class is basically empty.

The cryptographer’s move is to make a space that big and then hide a single point inside it. That is the whole trick. Everything else — the S-boxes, the rounds, the modular arithmetic, the elliptic curves — is machinery for making sure that the only way to find the point is to visit the points.

Notice what happens as you drag. Human quantities run out almost immediately. By 10¹⁹ you have exhausted the sand. By 10²³ you have exhausted the stars and the molecules in a teaspoon of water, and then the landmarks simply stop. Fifteen orders of magnitude go by with nothing in them before AES-128 appears at 10^38.5. Past that, the only markers left are the atoms in the Earth and two more key sizes: the ladder has run out of physical objects and is now measuring nothing but manufactured space. That emptiness is the product. We made it.

The cryptographer’s job is to make the world bigger on purpose.

Two · What it costs to look

Give the attacker everything. It still is not enough — but not for the reason you have been told.

There is a line you have heard: if you turned every atom in the universe into a computer, you still could not brute-force AES-256. It is a wonderful line. It is also false, and the instrument below will tell you so if you ask it.

Run the numbers. Ten to the eighty atoms, each managing a billion guesses a second, running since the Big Bang: that is about 4.4 × 10¹⁰⁶ attempts — roughly 2³⁵⁴, which overshoots a 256-bit key space by nearly thirty orders of magnitude. Spread the work out and each atom has to perform about one thousandth of a single operation, total, in the lifetime of the universe. Atom-counting is a comparison of magnitudes. It was never a bound on computation, and treating it as one is the single most common error in popular writing about this subject.

Press the last preset. It breaks. A 256-bit key falls to a universe of atoms running since the beginning of time, and that is the honest answer, and it is the reason the real argument is not combinatorial at all. It is thermodynamic.

Landauer’s principle says that erasing one bit of information costs at least kT ln 2 joules of energy. Not with today’s transistors — ever, with any machine made of matter that throws information away. Take the temperature to be 3.2 K — the figure Schneier used in 1996, a shade above the 2.725 K cosmic microwave background, and conservative in the attacker’s favour — and the cost of merely counting from zero to 2²⁵⁶ — not decrypting anything, just advancing a counter — comes to about 3.5 × 10⁵⁴ joules. That is around thirty billion times everything the Sun will radiate in its entire ten-billion-year life. It is thirty-five billion supernovae, spent on the odometer.

And here is the part that is usually left out, because it complicates the story: this argument does not save AES-128. At the Landauer limit, 2¹²⁸ bit erasures cost about 10¹⁶ joules, which is under an hour of humanity’s electricity production. What protects AES-128 is not physics. It is that no machine ever built operates within a hundred million times of the Landauer limit, and that 2¹²⁸ serial operations cannot be organised in the time available. Two different barriers, at two different key lengths. Conflating them is how a true thing becomes a slogan.

Bruce Schneier, 1996: brute-force attacks against 256-bit keys will be infeasible “until computers are built from something other than matter and occupy something other than space.”

Three · Why searching does not work

A key that is right in every bit but one is worth exactly as much as a guess.

In 2016 a machine beat Lee Sedol, one of the strongest Go players who has ever lived. Go has around 10¹⁷⁰ legal positions — vastly more than the 10³⁸ keys in an AES-128 key space. The larger space fell and the smaller one did not. Why?

Because Go has a gradient. Positions that are similar have similar values. A move that is nearly good is nearly good. That correlation is the handhold that every learning algorithm, every search heuristic, every human intuition climbs. Take it away and intelligence has nothing to grip.

Cryptography’s central engineering achievement is the deliberate destruction of that handhold. It is called the avalanche effect: change one bit of the input and every output bit becomes an independent coin flip. There is no warmer, no colder. A safecracker exploits the faint click of a wheel falling into place; a cipher is a lock engineered to be perfectly silent.

This is what makes a key space genuinely unsearchable rather than merely large. You are not looking for a needle in a haystack; a needle is magnetic and sharp and a magnet finds it. You are looking for one particular piece of hay, in a field where every piece is identical until you test it, and testing tells you only no.

A cipher is not like a big world. A cipher is a big world with the learnability surgically removed.

Four · Things do break

Ciphers die constantly. Cryptography has never once stopped.

Any claim that cryptography “won’t be broken” has to survive contact with the record, and the record is a cemetery. Not of exotic failures — of standards. Things that shipped in every browser and every bank.

Look at the shape of it. DES fell to brute force. MD5, SHA-1, RC4 and WEP fell to cryptanalysis. Dual_EC_DRBG was never broken at all — it was subverted, standardised with a structure that let whoever chose its parameters predict its output. And SIKE and Rainbow, the two most recent graves, were candidates in the post-quantum competition: not fringe entries, but a round-four candidate with a $50,000 prize on it and a signature finalist. SIKE was broken in about ten minutes on a single core, using a theorem from 1997. No quantum computer was involved in either.

The lesson is not that cryptography is fragile. It is the opposite, and it is stranger. Every one of those deaths was survived by the thing that depended on it. Your bank did not stop working when SHA-1 died. The web did not go dark when RC4 was prohibited. The primitives are mortal; the discipline is not. It buries its dead and keeps walking, and it has been doing that for fifty years without a single interruption in service.

Cryptography survives and ciphers die, and that is not a failure of the field. It is the mechanism of it.

Five · What the quantum computer actually takes

Two entirely different stories keep getting told as one.

Grover’s algorithm searches an unstructured space of size N in about √N steps. That is a quadratic speedup, and it is provably the best any quantum computer can do at unstructured search. Against symmetric encryption it halves your effective key length: AES-256 drops to about 128 bits of quantum security.

So the answer to Grover is embarrassingly boring: use longer keys. We did not invent a new mathematics to survive quantum search. We doubled a number, paid about forty percent more compute, and moved on.

Shor’s algorithm is a different animal entirely. It does not make factoring quantitatively harder to attack; it moves factoring and discrete logarithm into polynomial time — down from sub-exponential for RSA and finite-field Diffie–Hellman, and from fully exponential for elliptic curves. Those schemes do not get weaker. They end. The entire public-key layer of the internet rests on problems that a sufficiently large quantum computer solves outright.

And so the field did what the field does. NIST ran an open competition for eight years; watched two candidates die publicly; and published ML-KEM, ML-DSA and SLH-DSA as FIPS 203, 204 and 205 on 13 August 2024, with the code-based HQC selected in March 2025 as a deliberately different-mathematics backup. Estimates for breaking RSA-2048 have fallen from twenty million noisy qubits in 2019 to under a million in 2025; the largest machines built run to a thousand or so physical qubits and roughly a dozen logical ones, which is the number that matters. Neither of those curves is flat. Nobody serious is claiming this is settled.

Which brings up the objection that has no answer: harvest now, decrypt later. An adversary who records your traffic today does not need a quantum computer today. Michele Mosca stated it as an inequality — if the time your data must stay secret, plus the time your migration takes, exceeds the time until a capable quantum computer exists, you are already exposed, and no future action fixes it. Today’s secrecy is a loan against a future nobody controls.

Six · Why the discipline outlives its algorithms

One more bit costs you nothing and costs them everything.

Strip away the specifics and one asymmetry is doing all the work. Add a single bit to a symmetric key and the defender pays for one extra bit of storage and approximately zero extra computation. The attacker’s workload doubles. Not increases — doubles, every time, forever.

That is the engine. Defence scales linearly in cost and exponentially in effect. Every decade of Moore’s law hands the attacker a handful of bits; the defender hands them back with a shrug. AES-256 is 128 bits longer than AES-128 — a factor of 3.4 × 10³⁸ in brute-force cost — and it runs about forty percent slower. That is the entire price.

Two honest qualifications, because this is the load-bearing claim of the whole essay. First: the asymmetry does not hold for public-key cryptography. RSA’s security grows sub-exponentially in key length under the number field sieve, and RSA operations cost O(n³), which is exactly why RSA keys are 2048 bits and AES keys are 256, and why elliptic curves displaced RSA. Second: the attacker has an asymmetry too, and Schneier stated it as a maxim borrowed from the NSA — attacks always get better; they never get worse. A published break is permanent. Security is a monotonically decreasing function of time. “Nobody has broken it yet” is evidence, never proof.

Put those together and you get something more interesting than a fortress. You get an immune system — and not loosely, because the mechanism is the same shape. Your adaptive immune system builds its receptor repertoire by randomly recombining gene segments, manufacturing an enormous diversity of shapes in advance of ever meeting the thing it will have to recognise. That is a cryptographer's move exactly: generate the space combinatorially, because you cannot know in advance which point in it you are going to need. And the rest of the resemblance holds too. It keeps a memory of what it has already seen. It loses individual engagements constantly. It has never been undefeated, and it has never stopped.

The mechanism that makes this work as an institution is a rule from 1883. Kerckhoffs’s principle says the security must live in the key, not in the design — so the design can be published, attacked, and replaced without anyone losing anything but the design. That is why cryptography can hold open competitions to break its own candidates. It is a ratchet: one-way, gain-holding, and perfectly willing to shed teeth.

Cryptography has never been undefeated. It has only never been defeated finally.

Seven · The Big World Hypothesis

Somebody else noticed that bigness changes what is possible — and they were not talking about ciphers at all.

In August 2024, at a workshop of the first Reinforcement Learning Conference, Khurram Javed and Richard S. Sutton put a name to something that had been in the water for years. Here is what they actually wrote, verbatim, because it is worth getting right:

“The big world hypothesis says that in many decision-making problems the agent is orders of magnitude smaller than the environment. It can neither fully perceive the state of the world nor can it represent the value or optimal action for every state.”

The consequences they draw are practical, not mystical. If the agent is permanently smaller than its world, then approximation is not a stopgap on the way to an exact solution — it is the permanent condition. Learning cannot be something you finish before deployment; it has to happen continually, online, forever, with the agent discarding what it no longer needs to make room for what it does. They call that tracking. And they argue the condition does not dissolve as computers improve, for two reasons that are hard to dodge: our sensors scale with compute too, so the flood of experience grows alongside the capacity to process it; and the world contains other agents, who also get bigger, so modelling it exactly means modelling them exactly.

“The big world hypothesis is not a temporary artifact of the limitations of our current computers. For many problems, the world will always be much larger than any single agent.”

Where the analogy holds — and where it breaks

The rhyme is real. A codebreaker is a bounded agent facing a world orders of magnitude larger than itself, unable to represent it, unable to enumerate it, forced into approximation. Cryptography is what it looks like when someone constructs that condition on purpose, as a weapon, with a guarantee attached.

But the analogy has a seam, and the seam is the most interesting thing in this essay. The method Javed and Sutton propose comes with a precondition. Tracking works, they say, only where the world has temporal coherence — where what you see now is correlated with what you saw a moment ago — because that correlation is what lets a small agent spend its tiny budget on the part of the world that is about to matter. Their argument does not claim every big world is like that. It says that where a big world is like that, a small agent has something to work with.

A key space is the other case. It is big and engineered to be structureless: no coherence, no correlation, no regularity anywhere in it, because any regularity is a foothold and a foothold is a break. So the two are not the same claim. They are two ends of one axis — how much structure does a big space leave lying around? — and that axis reframes every real cryptographic failure in the record. DES fell to size. Everything after it fell to structure getting back in: differential paths, statistical biases, torsion-point information, an exploitable curve. Every genuine break is the same story, a big world turning out to have been slightly learnable after all.

One caution, since this essay is going to lean on their idea. Javed and Sutton make a deliberately scoped claim about which problems artificial-intelligence research should care about — they say explicitly that the hypothesis “is more a statement about the class of problems we should care about than a fact about all decision-making problems.” They do not mention cryptography. They do not cite Ashby, or Simon, or Borges. Everything from here on is the present author’s extension, and where it goes wrong, it goes wrong on this author’s account, not theirs.

Eight · More choice, less control

It sounds like a contradiction. It is a subtraction.

Here is the claim that made this essay worth writing: a big combinatorial world gives you more choice and less control, and those are not two facts in tension. They are one fact viewed from two positions.

In 1956 the cyberneticist W. Ross Ashby stated and proved the Law of Requisite Variety, usually compressed to five words: only variety can destroy variety. A regulator can hold a system steady only if it commands at least as many distinct responses as the system has distinct disturbances. Fall short and regulation is not merely difficult, it is impossible — not for want of effort or funding, but arithmetically, the way you cannot fit six pigeons in five holes.

Now put the two quantities side by side.

Choice is an existence claim. To have a choice you need one path through the space. One key. One route. Choice grows with your size, one bit at a time — linearly, cheaply, and it never needs to know what else is in there.

Control is a universal claim. To control something you need a response for every state it can be in. Control grows with the ratio of your variety to the world’s — and in a big world that ratio is a subtraction between exponents. Every bit the world gains halves it.

Drag the world to the right and watch. Choice climbs. Control collapses. Nothing contradictory happened. You performed a subtraction, and one of the two quantities was an exponent.

This is what encryption hands an individual, and it is genuinely new in history. Since 1976 an ordinary person has been able to construct a fact that no institution can compel into the open by force — not because the institution is weak, but because the arithmetic does not permit it. The state can jail you, subpoena you, own your vendor, and read your metadata. It cannot make 2²⁵⁶ smaller.

And the same arithmetic is why nobody gets to steer the whole thing. Not you. Not your government. Not a future superintelligence, which will be enormous and will still be smaller than the space it is inside. You cannot audit what you cannot search. The mathematics protects the dissident and the extortionist with identical fidelity, because it does not know the difference and cannot be taught it. Indifference at that scale is not a bug in the system. It is the system, and it is the price of the guarantee.

You need one path through the space. Anyone who would govern you needs all of them.

Nine · Everything wrong with what you just read

The strongest arguments against this essay, without flinching.

It is never broken. It is bypassed.

This is the objection that matters most, and it is close to fatal. Almost no real-world failure is mathematical. For decades the CIA and the BND covertly owned Crypto AG, the Swiss company selling encryption equipment to more than a hundred governments — the mathematics was impeccable and the vendor was theirs. Dual_EC_DRBG attacked the randomness rather than the cipher. Law enforcement has run entire “encrypted phone” platforms. And metadata, which encryption does not touch, is frequently the payload: Michael Hayden’s “we kill people based on metadata” is usually quoted without his immediate qualification, and the structural point survives the qualification anyway. Encryption protects the letter, not the fact that you wrote it, to whom, how often, at what hour, from where.

The honest concession: the exponential lives in one primitive and does not propagate to the system around it. Encryption is not armour. It is fog. Fog does not stop force — anyone who can walk up and touch you defeats it trivially. What fog destroys is scale. Every bypass is per-target: a warrant, an implant, an operation, a wrench. Cryptography did not make surveillance impossible. It made bulk content surveillance expensive and forced it to become targeted. That is real, and it is much smaller than the claim we started with.

The hardness assumptions are unproven.

Nearly all of this rests on conjecture. We do not know that one-way functions exist. We have not proved P ≠ NP. Russell Impagliazzo sketched five possible worlds we might be living in, and declined to guess which one it is. If we live in the wrong one, the thesis is not weakened — it is simply false. And the strongest form of this objection is not about P versus NP at all: SIKE survived years of expert scrutiny inside a NIST competition and then died in about ten minutes on a single processor core. Lattice cryptanalysis is a young field.

“More choice” is not evenly distributed.

Encryption is universal; competence is not. Usability was never solved — it was routed around, by shipping strong cryptography on by default inside a handful of products, which means the autonomy most people enjoy is real and it is leased. Your end-to-end encryption is a corporate policy decision, revocable by the board that made it, running client code you did not write and cannot audit. Phillip Rogaway’s The Moral Character of Cryptographic Work makes the harder version of this argument: the field is political, it has often served power, and its contribution to ordinary privacy has been oversold. What survives is narrower than the slogan: the option to hold your own keys is genuinely open in a way it was not before 1976, and the small population that exercises it — journalists, lawyers, sources, dissidents — is exactly the population for whom it decides outcomes.

“Less control” is not what the record shows.

The last thirty years are the best-documented expansion of surveillance in history, and it happened during cryptography’s triumph. Concede it completely. The structural reason is that most deployed cryptography protects confidentiality against outsiders, which produces an insider monopoly: TLS protects your traffic from your ISP and hands it, in the clear, to the platform. Encryption at rest protects data from a thief, not from the custodian. The dominant pattern reorganises who can see rather than reducing what is seen, and it concentrates. Meanwhile the share of life that is digitally legible grew far faster than the share that is encrypted.

So “less control” cannot mean power is in retreat. It is not. It means something smaller and stranger: there now exists a narrow class of facts that no amount of power can compel into the open, and that class is structurally permanent. Bigness guarantees a residue, not a sanctuary.

And the reciprocal is true, and less often said: institutions do not get control from bigness either. The Privacy and Civil Liberties Oversight Board, reviewing the bulk telephone metadata programme in January 2014, reported that it had “not identified a single instance involving a threat to the United States in which the program made a concrete difference in the outcome of a counterterrorism investigation.” They collected the haystack. It did not produce the needle. That is Ashby’s law arriving with a budget line.

Ten · What is actually true

We did not get a sanctuary. We got a residue.

So: is cryptography ever going to be broken? The quote we started with says no, and after all of that the answer is: not in the way the question means, and constantly in every other way.

Individual algorithms will keep dying — to cryptanalysis, to a theorem nobody saw coming, to a machine that does not exist yet, to a vendor who was never on your side. That is not the failure case. That is the observed steady state, running for fifty years, and every death so far has been survived by the thing that depended on it.

What is unlikely to break is the situation: that a defender can manufacture a combinatorial space so large, and so deliberately free of structure, that no bounded agent can search it — and that adding one more bit to that space costs the defender almost nothing while costing the searcher everything. That asymmetry is not a fact about our current technology. It is a fact about exponentials, and about what it means to be smaller than the thing you are inside.

Javed and Sutton were describing an agent trying to learn a world too big to represent. Cryptographers spend their careers building worlds like that on purpose. And the rest of us live in one, having discovered — with some delight and some vertigo — that a space nobody can search is a space in which you can always find another door, and never the map.

That is the whole of it. More choice, less control. One space, two positions. Nothing has been resolved; the arithmetic simply does not offer a resolution, and pretending otherwise would be the only real dishonesty available here.

The same conjecture that lets you keep a secret is the conjecture that stops anyone from running the world.